HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 29, 2018.
- Organization as reported
- Middletown Medical P.C., NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- March 29, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13877, row:5016)
- Archived copy
- Held in the private archive (provenance)
A misconfigured radiology interface application permitted unauthorized individuals to access 63,551 patients’ electronic protected health information (ePHI). The ePHI affected by this incident included patients’ names, dates of birth, client identification numbers, dates of service, and, for approximately 250 patients, radiology reports and images. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE secured the radiology application so that only authorized staff could access it, amended its policies and procedures to require that all systems and their security settings be tested in a test environment prior to live deployment, and trained relevant workforce members regarding this policy change. The CE also sanctioned the workforce member responsible for this incident. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to perform a risk analysis and establish a risk management plan, and document the unauthorized disclosure of its patients’ ePHI for accounting of disclosure purposes. Also, the CE is expected to perform a technical and non-technical evaluation in response to environmental or operational changes, regularly review records of activity in all information systems, implement procedures for monitoring log-in attempts, and implement audit controls and valid encryption processes.